SAST scanner configuration file

General configuration file keys

Here is a simple and recommended overview of the general configuration file keys. Remember that this applies to all of Fluid Attacks' scanners.

                            namespace: myapp
output:
  file_path: ./Fluid-Attacks-Results.csv
  format: CSV
working_dir: .
language: EN
                        

Specific configuration file keys

The following keys are available only for the SAST scanner.

file_size_limit

By default, there is a file size limit to prevent long analysis times. Set file_size_limit to false to remove the limit if crucial files are omitted because of it:

file_size_limit: false

sast

This key has three configuration options:

include (mandatory): Paths to files or directories to analyze
exclude (optional): Files or directories to exclude from the analysis
recursion-limit (optional): An integer limit for recursion depth, which is useful if SAST execution takes too long (over 1 hour) or encounters memory/recursion errors (the recommended and default value for this option is 1000)

For example:

sast:
  include:
    - relative/path/to/file
    - relative/path/to/directory/
  # Optional keys
  exclude:
    - glob(**/node_modules/)
  recursion-limit: 1000

Specify paths in the include/exclude subsections

You can specify your paths in two different ways:

Using a path relative to the working directory (if the working_dir key is not defined, the working directory is automatically set to the same directory you called the scanner execution), for example:

                                namespace: namespace
working_dir: /test/directory
sast:
  include:
    - src/main/java/org/test/Test.java

                            

Using Unix-style globs, relative to working_dir, for example:

                                namespace: namespace
working_dir: /test/directory
sast:
  include:
    - glob(*)
  exclude:
    - glob(**.java)
    - glob(src/**/test*.py)

                            

The recommended configuration is to scan all paths of working_dir by using . in the include option:

Configuration file example

Below is an example of a highly personalized configuration file:

namespace: my_app
working_dir: ./
commit: e59607b9de3ef4c13d292705fg3da1ff0c67eb38
language: EN
output:
  file_path: /fluid-attacks-results.csv
  format: CSV
checks:
  - F052
strict: false
file_size_limit: false
sast:
  include:
    - src/main/java/org/test/Test.java
    - glob(**.py)  exclude:
    - glob(src/**/test*.py)

Have a question about the scanner or encountered a problem? Read the scanner FAQ.

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.